Method and computer program product for backing up and restoring online system information

[0001] 1. Field of the Invention

[0002] The disclosed invention relates to RAID array controllers, and more particularly to a method and computer program product for backing up and restoring online system information.

[0003] 2. Background Art

[0004] There are many applications, particularly in a business environment, where there are storage needs beyond those that can be fulfilled by a single hard disk, regardless of its size, performance or quality level. Many businesses can't afford to have their systems go down for even an hour in the event of a disk failure. They need large storage subsystems with capacities in the terabytes. And they want to be able to insulate themselves from hardware and software failures to any extent possible. Some people working with multimedia files need fast data transfer exceeding what current drives can deliver, without spending a fortune on specialty drives. These situations require that the traditional “one hard disk per system” model be set aside and a new system employed. This technique is called Redundant Arrays of Inexpensive Disks or RAID. (“Inexpensive” is sometimes replaced with “Independent”, but the former term is the one that was used when the term “RAID” was first coined by the researchers at the University of California at Berkeley, who first investigated the use of multiple-drive arrays in 1987. See D. Patterson, G. Gibson, and R. Katz. “A Case for Redundant Array of Inexpensive Disks (RAID)”, Proceedings of ACM SIGMOD '88, pages 109--116, June 1988.

[0005] The fundamental structure of RAID is the array. An array is a collection of drives that is configured, formatted and managed in a particular way. The number of drives in the array, and the way that data is split between them, is what determines the RAID level, the capacity of the array, and its overall performance and data protection characteristics.

[0006] It should be understood that RAID arrays are typically formed by partitioning one or more disks. Each partitioned area on the disk may be referred to as a storage device. One or more storage devices constitutes the RAID array. Mirrored arrays are typically formed on two or more separate and distinct disks.

[0007] An array appears to the operating system to be a single logical hard disk. RAID employs the technique of striping, which involves partitioning each drive's storage space into units ranging from a sector (512 bytes) up to several megabytes. The stripes of all the disks are interleaved and addressed in order.

[0008] Most modern, mid-range to high-end disk storage systems are arranged as RAID configurations. A number of RAID levels are known. JBOD stands for Just a Bunch of Drives. The controller treats one or more disks or unused space on a disk as a single array. JBOD provides the ability to concatenate storage from various drives regardless of the size of the space on those drives. JBOD is useful in scavenging space on drives unused by other arrays. JBOD does not provide any performance or data redundancy benefits.

[0009] RAID 0, or striping, provides the highest performance but no data redundancy. Data in the array is striped (i.e. distributed) across several physical drives. RAID 0 arrays are useful for holding information such as the operating system paging file where performance is extremely important but redundancy is not.

[0010] RAID 1, or mirroring, mirrors the data stored in one physical drive to another. RAID 1 is useful when there are only a small number of drives available and data integrity is more important than storage capacity.

[0011] RAID 1n, or n-way mirroring, mirrors the data stored in one hard drive to several hard drives. This array type will provide superior data redundancy because there will be three or more copies of the data and this type is useful when creating backup copies of an array. This array type is however expensive, in both performance and the amount of disk space necessary to create the array type.

[0012] RAID 10 is also known as RAID (0+1) or striped mirror sets. This array type combines mirrors and stripe sets. RAID 10 allows multiple drive failures, up to 1 failure in each mirror that has been striped. This array type offers better performance than a simple mirror because of the extra drives. RAID 10 requires twice the disk space of RAID 0 in order to offer redundancy.

[0013] RAID 10n stripes multiple n-way mirror sets. RAID 10n allows multiple drive failures per mirror set, up to n-1 failures in each mirror set that has been striped, where n is the number of drives in each mirror set. This array type is useful in creating exact copies of an array's data using the split command. This array type offers better random read performance than a RAID 10 array, but uses more disk space.

[0014] RAID 5, also known as a stripe with parity, stripes data as well as parity across all drives in the array. Parity information is interspersed across the drive array. In the event of a failure, the controller can rebuild the lost data of the failed drive from the other surviving drives. This array type offers exceptional read performance as well as redundancy. In general, write performance is not an issue due to the tendency of operating systems to perform many more reads than writes. This array type requires only one extra disk to offer redundancy. For most systems with four or more disks, this is a desirable array type.

[0015] RAID 50 is also known as striped RAID 5 sets. Parity information is interspersed across each RAID 5 set in the array. This array type offers good read performance as well as redundancy. A 6-drive array will provide the user with 2 striped 3-drive RAID 5 sets. Generally, RAID 50 is useful in very large arrays, such as arrays with 10 or more drives.

[0016] Thus RAID or Redundant Array of Independent Disks are simply several disks that are grouped together in various organizations to either improve the performance or the reliability of a computer's storage system. These disks are grouped and organized by a RAID controller.

[0017] Each conventional RAID controller has a unique way to lay out the disks and store the configuration information. On the other hand, a system controlled by a common Operating System (OS) has a known format. When users try to add a RAID controller to their system, the most important task is to migrate the existing data disks to a RAID controlled system. The common operating system configuration format to control and communicate with a disk in the system is referred to as “metadata”. The OS metadata is different from the RAID controller's unique configuration format which is also referred to as “metadata”.

[0018] In the early days of RAID, fault tolerance was provided through redundancy. However, problems occurred in situations where a drive failed in a system that runs 24 hours a day, 7 days a week or in a system that runs 12 hours a day but had a drive go bad first thing in the morning. The redundancy would let the array continue to function, but in a degraded state. The hard disks were typically installed deep inside the server case. This required the case to be opened to access the failed drive and replace it. In order to change out the failed drive, the other drives in the array would have to be powered off, interrupting all users of the system.

[0019] If a drive fails in a RAID array that includes redundancy, it is desirable to replace the drive immediately so the array can be returned to normal operation. There are two reasons for this: fault tolerance and performance. If the drive is running in a degraded mode due to a drive failure, until the drive is replaced, most RAID levels will be running with no fault protection at all. At the same time, the performance of the array will most likely be reduced, sometimes substantially.

[0020] An important feature that allows availability to remain high when hardware fails and must be replaced is drive swapping. Strictly speaking, the term “drive swapping” simply refers to changing one drive for another. There are several types of drive swapping available.

[0021] “Hot Swap”: A true hot swap is defined as one where the failed drive can be replaced while the rest of the system remains completely uninterrupted. This means the system carries on functioning, the bus keeps transferring data, and the hardware change is completely transparent.

[0022] “Warm Swap”: In a so-called warm swap, the power remains on to the hardware and the operating system continues to function, but all activity must be stopped on the bus to which the device is connected.

[0023] “Cold Swap”: With a cold swap, the system must be powered off before swapping out the disk drive.

[0024] Another approach to dealing with a bad drive is through the use of “hot spares.” One or more additional drives are attached to the controller and are not used by I/O operations to the array. If a failure occurs, the controller can use the spare drive as a replacement for the bad drive.

[0025] The main advantage that hot sparing has over hot swapping is that with a controller that supports hot sparing, the rebuild will be automatic. The controller detects that a drive has failed, disables the failed drive, and immediately rebuilds the data onto the hot spare. This is an advantage for anyone managing many arrays, or for systems that run unattended.

[0026] Hot sparing and hot swapping are independent but not mutually exclusive. They will work together, and often are used in that way. However, sparing is particularly important if the system does not have hot swap (or warm swap) capability. The reason is that sparing will allow the array to get back into normal operating mode quickly, reducing the time that the array must operate while it is vulnerable to a disk failure. At any time either during rebuild to the hot spare or after rebuild, the failed drive can be swapped with a new drive. Following the replacement, the new drive is usually assigned to the original array as a new hot spare.

[0027] When a RAID array disk drive goes bad, the system must make changes to the configuration settings to prevent further writes and reads to and from the bad drive. Whenever a configuration change happens, the configuration changes have to be written out to all of the disks in the RAID array.

[0028] When the operating system or an application wants to access data on a hard disk before it has loaded native drivers for disk access, it traditionally employs BIOS services to do this. BIOS is the abbreviation for Basic Input/Output System. The BIOS provides basic input and output routines for communicating between the software and the peripherals such as the keyboard, screen and the disk drive. The BIOS is built-in software that determines what a computer can do without accessing programs from a disk. The BIOS generally contains all the code required to control the keyboard, display screen, disk drives, serial communications, and a number of miscellaneous functions. While the access is not necessarily optimal, it is done through an easy to use interface for minimal code can access these devices until the more optimal drivers take over.

[0029] The BIOS is typically placed on a ROM (Read Only Memory) chip that comes with the computer (it is often called a ROM BIOS). This ensures that the BIOS will always be available and will not be damaged by disk failures. It also makes it possible for a computer to boot itself.

[0030] When users perform complex tasks, they sometimes make mistakes that result in missing RAID arrays or lost data. It is very difficult to find out what happened and recover the missing arrays and data. This can be devastating to a business that has large numbers of records stored in the arrays. It is imperative that there be some way to recover the missing or lost data. Therefore, what is needed is a method and system to easily recover missing arrays and data.

[0031] This invention comprises a method for storing and retrieving critical system information from accidental or malicious data loss. By storing first the critical data in a mirrored storage device, and then dividing it into at least two disjoint storage devices and by hiding one of the storage devices from the Operating System or any user of the computer, a copy of the critical system information can be hidden away. When partial or total data loss occurs, the hidden storage device can be used to substitute for the damaged storage device by replacing it with the hidden storage device. The operation can be repeated to create a fresh backup copy of the restored critical information.

[0045] While the present invention is described herein with reference to illustrative embodiments for particular applications, it should be understood that the invention is not limited thereto. Those skilled in the art with access to the teachings provided herein will recognize additional modifications, applications, and embodiments within the scope thereof and additional fields in which the invention would be of significant utility. This invention will be described in terms of a standard Intel® processor PC system. Those persons skilled in the relevant arts will recognize that this invention can be implemented with other processor PC systems equally as well.

[0046] The present invention is primarily directed to a method and system for protecting a computer system using RAID from accidental or malicious data loss. Many organizations have a great need to store large amounts of data accurately. A loss of all or part of that data could be catastrophic to the operation of the organization. This problem can be resolved by storing the critical data in a mirror (RAID 1 or RAID 10) array. The mirror is then split into two arrays (e.g., JBOD or RAID 0) and access to one of the arrays is strictly limited (or hidden). Not even the operating system can access the hidden data. Only the system administrator has access to the key to unlock or unhide the hidden array, in the event access to that array is needed. In this way, a copy of the data can be safely stored and accidental or malicious data loss can be avoided. If a partial or total data loss occurs on the “public” side of the array, due, for example, to disk failures, the hidden copy can be accessed and used to recreate the lost data.

[0047] Microsoft Windows XP® has a utility called “system restore” which allows critical data to be backed up and restored. However this utility does not protect the computer when an array (e.g., volume, disk, etc.) is lost. This is because the data in the array is not backed up as part of the critical Windows system data. If the data in the array is not backed up, it cannot be restored as part of the “system restore” process.

[0048] A typical RAID controller contains a common function called a “split” command. This command essentially separates a mirrored array such as a RAID level 1 or level 10 array into two (initially identical) arrays. The operating system can then write separately to each of these arrays. One of the arrays can be considered a backup array. Another common function of RAID controllers is the “merge” function. This function permits the two arrays to be reconnected and merged.

[0049] The inventors have analyzed these operations and have determined that a deficiency of the conventional “split” and “merge” functions is that they do not address the problem of corrupted data being written to a disk, or the problem of a bad disk. As noted above, when an array is split, both arrays are visible to the Operating System. A malicious user or program can write to both arrays. Obviously, it will not be possible to restore data if both arrays are corrupted.

[0050] This issue is resolved by the present invention. In this invention, two additional commands are implemented in the RAID controller. These are called respectively “hide” and “unhide” commands. The “hide” command renders an array effectively invisible to the operating system. Neither software (e.g., a virus) nor a malicious user can write to the hidden array. When the hide command is invoked, the RAID controller does not provide a path allowing anything in the system to write to or read from that array. When the “unhide” command is invoked, the RAID controller opens a path that allows the operating system to access the array and to write to and/or read from that array.

[0051] In one example of the present invention, when a “split” command is executed, the default operation also “hides” the split-off mirror copy. It will be apparent to one skilled in the art that, in an alternative arrangement, the default can be changed so that when a “split” command is invoked, the “hide” command will be an option that must also be invoked by the user.

[0052] The present invention can also be used with non-mirrored arrays, such as a RAID 5 set or any other non-mirrored array. In this example, the RAID controller contains a “copy and hide” command. Invoking this command will call for a copy to be made of the RAID 5 set. The copy will be hidden from the operating system for backup purposes in the same way as the “split and hide” command is used for mirrored arrays, such as RAID 1 and RAID 10 sets.

[0053] The hide and unhide commands are advantageously implemented as part of the RAID controller BIOS function and as part of software running under the operating system. The present invention is operating system independent. For example, this invention can be operated with Linux systems as well as with Microsoft Windows® platforms.

[0054] In addition, the present invention can be used to make protected copies of part of an array. FIG. 1 shows how critical data in a first array can be selectively stored in a plurality of backup arrays. Critical data in the first array that requires backup and preservation is copied to the second, third, and/or fourth arrays. The copying can be done automatically if the RAID set is a mirrored array. Alternatively, the backup can be done manually or by means of any other automatic copying technique from the first array. The data that is to be considered “critical data” for this purpose and preserved in a protected area can be defined by the user. Typically the critical data would comprise all the data in the array,

[0055] If the first and second arrays are mirrored, the user splits the two arrays with a default or manually selected “hide” of the second array. If the arrays are not mirrored, the user manually starts a copy operation from one array to a second hidden array.

[0056] If there is sufficient unused disk capacity, a series of backups can be stored by periodically repeating the process. These result in a series of backups, e.g., Backup array #1, Backup array #2, and Backup array #3, for example, run on successive dates. The backup process can be run on a daily, weekly, or any other periodic or a periodic schedule. Upon a hardware failure or contamination of data, the user can unhide one of the backup arrays. It will be apparent to persons skilled in the relevant art(s) that the number of backup arrays is not critical.

[0057] One of the features of the present invention is the ability to instantly switch to a backup array in the event of a drive failure or data contamination or corruption. If a drive failure or corruption is detected, the user (e.g., system. administrator) can perform an unhide operation. The (or one of the) backup array(s) will immediately come on line and the corrupted array will be taken off line. The corrupted array can then be removed and replaced. A new backup can be performed and the new backup array then hidden.

[0058] The following describes an implementation of the present invention using a RAIDCore RC4×52 RAID Controller, available from RAIDCore, a division of Broadcom Corporation, Nashua, N.H. With the present invention, protection can be obtained from two potential failure mechanisms—ill-behaved software and operators and disk failure.

[0059] Protection Against Viruses, Operator Error, and other Software Problems

[0060] On a server outfitted with, for example, two 36 GB drives, the RAID controller BIOS utility is used to create a single RAID 1 (mirrored) array that, for reasons discussed below, is, advantageously, slightly less than one-half the size of the full drive space. Approximately one half of the available disk space is used for the mirrored array. It will be apparent to persons skilled in the relevant art that the size of the drives or the mirrored array is not critical; any suitable drive size can be used. It is merely noted that drives from different vendors sometimes vary slightly in size even though they are advertised as being the same size. Because of this, it is useful not to use exactly one half of the available space, in the event a drive must be replaced (due to disk failure). It is helpful to use less than half the available space; alternatively, the replacement drive should advantageously be larger than the drive being replaced for best results. Thus, in the foregoing example, the usable drive space would be on the order of 17 GB.

[0061] At this stage, the RAID controller BIOS utility displays the new array as shown in FIG. 2.

[0062] Starting the Management Application, a new RAID 1 array appears as shown in FIG. 3 while it is being created. Once created, the mirrored array appears as shown in FIG. 4. Its capacity is, in this example, 18 GB. To the operating system, it appears as Disk 0 containing partition C, the boot partition. The array has been given a name (e.g., “W2003 7/15/03”) that includes the date. The reason for this naming will be discussed below.

[0063] At this point, the data will be protected against drive failure. However, it is not yet protected against malicious software (e.g. virus) or operator error. This is accomplished through mirror splitting, which allows the system administrator to work with one half of a mirror independently.

[0064] Using the Management Application, the mirrored array is split and one of the halves is then hidden. After the split, the arrays become two volumes as shown in FIG. 5.

[0065] Under the “O.S. Name” in the Array List, Array 2 is now hidden from the operating system. The array name is changed to add “Backup 7/15/03” to reflect when the split took place. Because the operating system cannot access a hidden array, there is no possibility of accidental or malicious damage to the contents of the hidden array.

[0066] Protecting Against Drive Failure

[0067] The data on the drives is now protected against ill-behaved software, viruses, and operator error. The data is not yet protected against drive failure. This is because the system disk (Array 1) is a volume. Using Online RAID Level Migration (ORLM), protection against drive failure is established using RAID 1, mirror splitting, and array hiding to create secure backups that are easily recovered.

[0068] To protect against drive failure using ORLM and mirror splitting, Array 1 is re-mirrored using a function called a “Transform” function in the RAID controller Management Application. This function enables ORLM by providing the ability to migrate an array of one RAID type to another RAID type while data storage is online and active.

[0069] The Transform function transforms the single drive Volume (C:) to a two-drive RAID 1 array of the same capacity. FIG. 6 shows the resulting Transform dialog box. As the array re-mirrors, the Management Application displays the transform progress as shown in FIG. 7.

[0070] After the mirror operation is finished, the data is completely protected.

[0071] Periodically, or when significant changes have been made to the system (such as installing new software or hardware), the array should be split and half should be hidden. The unused capacity can be used to mirror the hidden array, to keep an alternative backup of the system, or to store incremental backups of the active system drive. Again, it will be apparent to persons skilled in the relevant arts that the percent of available space used (and resulting unused capacity) is not critical. Any appropriate percentage can be allocated to the backup array.

[0072] Periodically, one of the older backups can be deleted, and the system drive split and re-mirrored. The new backup would then be labeled with the current date. FIG. 8 shows the current system drive and two backups taken on a weekly basis.

[0073] Recovering Data after Disk Failure or Data Loss/Corruption

[0074] Regardless of whether an entire disk is lost or only some portion of the data is lost or corrupted, returning to a working state as quickly as possible is imperative.

[0075] With a hot-swap-capable system, recovery from a disk failure using ORLM and mirror splitting can be accomplished by replacing the failed drive without shutting down the system. After attaching a new drive, the drive must be initialized. The initialization can be done either in the BIOS or with the RAID controller Management Application. Returning the system to its previous state entails re-mirroring the new drive and possibly splitting and re-mirroring again as was done when the system was created, depending on which half of the mirror failed.

[0076] Recovering from a corrupted array requires rebooting the machine into the RAID controller BIOS. In the BIOS, the current corrupted array is hidden using the Hide function. The backup hidden array that is to be restored is revealed using the Un-Hide function. This recovers the uncorrupted array and the lost data. After rebooting the system, the corrupted array can be deleted and the current array can be re-mirrored/split/re-mirrored as before. This returns the system to a completely protected state.

[0077] In practice, backups can be periodically tested. To test a backup array, the system is shut down, the array(s) to be tested is hidden or revealed, and the backup is booted to verify its integrity. Alternatively, a hidden array can be revealed while the system is operating, a Check Disk (CHKDSK) performed, and then the array is re-hidden.

[0078] The following description of a general purpose computer system is provided for completeness. The present invention can be implemented in hardware, or as a combination of software and hardware. Consequently, the invention may be implemented in the environment of a computer system or other processing system. An example of such a computer system 1200 is shown in FIG. 12. The computer system 1200 includes one or more processors, such as processor 1204. Processor 1204 can be a special purpose or a general purpose digital signal processor. The processor 1204 is connected to a communication infrastructure 1206 (for example, a bus or network). Various software implementations are described in terms of this exemplary computer system. After reading this description, it will become apparent to a person skilled in the relevant art how to implement the invention using other computer systems and/or computer architectures.

[0079] Computer system 1200 also includes a main memory 1205, preferably random access memory (RAM), and may also include a secondary memory 1210. The secondary memory 1210 may include, for example, a hard disk drive 1212, and/or a RAID array 1216, and/or a removable storage drive 1214, representing a floppy disk drive, a magnetic tape drive, an optical disk drive, etc. The removable storage drive 1214 reads from and/or writes to a removable storage unit 1218 in a well known manner. Removable storage unit 1218, represents a floppy disk, magnetic tape, optical disk, etc. As will be appreciated, the removable storage unit 1218 includes a computer usable storage medium having stored therein computer software and/or data.

[0080] In alternative implementations, secondary memory 1210 may include other similar means for allowing computer programs or other instructions to be loaded into computer system 1200. Such means may include, for example, a removable storage unit 1222 and an interface 1220. Examples of such means may include a program cartridge and cartridge interface (such as that found in video game devices), a removable memory chip (such as an EPROM, or PROM) and associated socket, and other removable storage units 1222 and interfaces 1220 which allow software and data to be transferred from the removable storage unit 1222 to computer system 1200.

[0081] Computer system 1200 may also include a communications interface 1224. Communications interface 1224 allows software and data to be transferred between computer system 1200 and external devices. Examples of communications interface 1224 may include a modem, a network interface (such as an Ethernet card), a communications port, a PCMCIA slot and card, etc. Software and data transferred via communications interface 1224 are in the form of signals 1228 which may be electronic, electromagnetic, optical or other signals capable of being received by communications interface 1224. These signals 1228 are provided to communications interface 1224 via a communications path 1226. Communications path 1226 carries signals 1228 and may be implemented using wire or cable, fiber optics, a phone line, a cellular phone link, an RF link and other communications channels.

[0082] The terms “computer program medium” and “computer usable medium” are used herein to generally refer to media such as removable storage drive 1214, a hard disk installed in hard disk drive 1212, and signals 1228. These computer program products are means for providing software to computer system 1200.

[0083] Computer programs (also called computer control logic) are stored in main memory 1205 and/or secondary memory 1210. Computer programs may also be received via communications interface 1224. Such computer programs, when executed, enable the computer system 1200 to implement the present invention as discussed herein. In particular, the computer programs, when executed, enable the processor 1204 to implement the processes of the present invention. Where the invention is implemented using software, the software may be stored in a computer program product and loaded into computer system 1200 using raid array 1216, removable storage drive 1214, hard drive 1212 or communications interface 1224.

[0084] In another embodiment, features of the invention are implemented primarily in hardware using, for example, hardware components such as Application Specific Integrated Circuits (ASICs) and gate arrays. Implementation of a hardware state machine so as to perform the functions described herein will also be apparent to persons skilled in the relevant art(s).

[0085] While various embodiments of the present invention have been described above, it should be understood that they have been presented by way of example, and not limitation. It will be apparent to persons skilled in the relevant art that various changes in form and detail can be made therein without departing from the spirit and scope of the invention.

[0086] The present invention has been described above with the aid of functional building blocks and method steps illustrating the performance of specified functions and relationships thereof. The boundaries of these functional building blocks and method steps have been arbitrarily defined herein for the convenience of the description. Alternate boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Any such alternate boundaries are thus within the scope and spirit of the claimed invention. One skilled in the art will recognize that these functional building blocks can be implemented by discrete components, application specific integrated circuits, processors executing appropriate software and the like or any combination thereof. Thus, the breadth and scope of the present invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.